@notabene/verify-proof 1.8.0 → 1.9.0

package/dist/tests/cosmos.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@notabene/verify-proof",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "Verify ownership proofs",
   "source": "src/index.ts",
   "type": "module",
@@ -44,8 +44,9 @@
   },
   "dependencies": {
     "@cardano-foundation/cardano-verify-datasignature": "^1.0.11",
+    "@cosmjs/amino": "^0.34.0",
     "@noble/curves": "^1.7.0",
-    "@notabene/javascript-sdk": "^2.11.0",
+    "@notabene/javascript-sdk": "2.11.0-next.2",
     "@scure/base": "^1.2.1",
     "@stellar/stellar-sdk": "^13.1.0",
     "bip322-js": "^2.0.0",

package/src/bitcoin.ts

@@ -117,7 +117,6 @@ export async function verifyBTCSignature(
           status: ProofStatus.FAILED,
         };
     }
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
   } catch (error) {
     console.error("error verifying proof", error);
     return {
@@ -169,10 +168,16 @@ function verifyBIP322(address: string, proof: SignatureProof) {
 }
 
 function verifyBIP137(address: string, proof: SignatureProof, chainConfig: ChainConfig) {
-  const segwit = Boolean(chainConfig.bech32Prefix && [DerivationMode.SEGWIT, DerivationMode.NATIVE].includes(
-    getDerivationMode(address)
-  ));
-  const verified = verify(proof.attestation, address, proof.proof, segwit, chainConfig);
+  const derivationMode = getDerivationMode(address);
+  
+  // For legacy addresses (starting with "1"), never use SegWit encoding
+  // For P2SH addresses (starting with "3"), use SegWit encoding if they have bech32 support
+  // For native SegWit addresses (bc1, tb1, ltc1), always use SegWit encoding
+  const useSegwitEncoding = Boolean(chainConfig.bech32Prefix && 
+    (derivationMode === DerivationMode.NATIVE || 
+     (derivationMode === DerivationMode.SEGWIT && !address.startsWith("1"))));
+  
+  const verified = verify(proof.attestation, address, proof.proof, useSegwitEncoding, chainConfig);
 
   return {
     ...proof,
@@ -191,6 +196,10 @@ function getDerivationMode(address: string) {
     return DerivationMode.DOGECOIN;
   } else if (address.match("^(q).*")) {
     return DerivationMode.BCH;
+  } else if (address.match("^(t1|t3).*")) {
+    return DerivationMode.LEGACY; // Zcash addresses
+  } else if (address.match("^[X7].*")) {
+    return DerivationMode.LEGACY; // Dash addresses
   } else {
     throw new Error(
       "INVALID ADDRESS: "
@@ -271,7 +280,22 @@ function verify(
       }
     }
   } else {
-    if (checkSegwitAlways && chainConfig.bech32Prefix) {
+    // For addresses starting with "3" (P2SH), try both P2SH-P2WPKH and legacy P2SH encodings if segwitType is undefined
+    if (address.startsWith("3") && !segwitType) {
+      // P2SH-P2WPKH: script hash of the redeem script (OP_0 <pubkeyhash>)
+      const redeemScript = new Uint8Array(22);
+      redeemScript[0] = 0x00; // OP_0
+      redeemScript[1] = 0x14; // push 20 bytes
+      redeemScript.set(publicKeyHash, 2);
+      const redeemScriptHash = hash160(redeemScript);
+      const p2shP2wpkh = encodeBase58AddressFormat(chainConfig.scriptHashVersion, redeemScriptHash);
+      // Legacy P2SH: script hash of the public key
+      const legacyP2sh = encodeBase58AddressFormat(chainConfig.scriptHashVersion, publicKeyHash);
+      if (address === p2shP2wpkh || address === legacyP2sh) {
+        return true;
+      }
+      actual = legacyP2sh; // fallback for error reporting
+    } else if (checkSegwitAlways && chainConfig.bech32Prefix) {
       try {
         actual = encodeBech32Address(publicKeyHash, chainConfig.bech32Prefix);
         // if address is bech32 it is not p2sh

package/src/cosmos.ts

@@ -0,0 +1,88 @@
+import {
+  CosmosMetadata,
+  ProofStatus,
+  SignatureProof,
+} from "@notabene/javascript-sdk";
+import { bech32 } from "bech32";
+import { StdSignDoc, serializeSignDoc } from "@cosmjs/amino";
+import { secp256k1 } from "@noble/curves/secp256k1";
+import { ripemd160 } from "@noble/hashes/legacy";
+import { sha256 } from "@noble/hashes/sha2";
+
+// Base64 decode
+function base64ToUint8Array(base64: string): Uint8Array {
+  return Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
+}
+
+// Base64 encode UTF-8 bytes
+function toBase64Bytes(str: string): string {
+  const utf8 = new TextEncoder().encode(str);
+  let binary = "";
+  for (let i = 0; i < utf8.length; i++) {
+    binary += String.fromCharCode(utf8[i]);
+  }
+  return btoa(binary);
+}
+
+// Cosmos address derivation (ADR-36)
+// https://github.com/cosmos/cosmos-sdk/blob/214b11dcbaa129f7b4c0013b2103db9d54b85e9e/docs/architecture/adr-036-arbitrary-signature.md
+function deriveCosmosAddress(pubkey: Uint8Array, prefix = "cosmos"): string {
+  const sha = sha256(pubkey);
+  const rip = ripemd160(sha);
+  return bech32.encode(prefix, bech32.toWords(rip));
+}
+
+export async function verifyCosmosSignature(
+  proof: SignatureProof
+): Promise<SignatureProof> {
+  try {
+    const [ns, , address] = proof.address.split(/:/);
+    if (ns !== "cosmos") {
+      return { ...proof, status: ProofStatus.FAILED };
+    }
+
+    // Parse the proof JSON
+    const pubKeyBytes = base64ToUint8Array(
+      (proof.chainSpecificData as CosmosMetadata).pub_key.value
+    );
+    const signatureBytes = base64ToUint8Array(proof.proof);
+
+    // Step 1: Derive address from pubkey
+    const derivedAddress = deriveCosmosAddress(pubKeyBytes);
+    if (derivedAddress !== address) {
+      return { ...proof, status: ProofStatus.FAILED };
+    }
+
+    // Step 2: Build MsgSignData + StdSignDoc
+    const signDoc: StdSignDoc = {
+      chain_id: "", // must match the signing process
+      account_number: "0",
+      sequence: "0",
+      fee: { amount: [], gas: "0" },
+      msgs: [
+        {
+          type: "sign/MsgSignData",
+          value: {
+            signer: address,
+            data: toBase64Bytes(proof.attestation),
+          },
+        },
+      ],
+      memo: "",
+    };
+
+    // Step 3: Serialize + hash
+    const signBytes = await serializeSignDoc(signDoc);
+    const digest = sha256(signBytes);
+
+    // Step 4: Verify using secp256k1
+    const verified = secp256k1.verify(signatureBytes, digest, pubKeyBytes);
+
+    return {
+      ...proof,
+      status: verified ? ProofStatus.VERIFIED : ProofStatus.FAILED,
+    };
+  } catch {
+    return { ...proof, status: ProofStatus.FAILED };
+  }
+}

package/src/index.ts

@@ -14,6 +14,7 @@ import { verifyCIP8Signature } from "./cardano";
 import { verifyPersonalSignXRPL } from "./xrpl";
 import { verifyStellarSignature } from "./xlm";
 import { verifyConcordiumSignature } from "./concordium";
+import { verifyCosmosSignature } from "./cosmos";
 
 export async function verifyProof(
   proof: OwnershipProof,
@@ -46,9 +47,10 @@ export async function verifyProof(
       return verifyPersonalSignXRPL(proof as SignatureProof, publicKey);
     case ProofTypes.XLM_ED25519:
       return verifyStellarSignature(proof as SignatureProof);
-    case ProofTypes.CONCORDIUM: {
+    case ProofTypes.CONCORDIUM: 
       return verifyConcordiumSignature(proof as SignatureProof);
-    }
+    case ProofTypes.COSMOS:
+      return verifyCosmosSignature(proof as SignatureProof);
     case ProofTypes.EIP712:
     case ProofTypes.BIP137:
     case ProofTypes.BIP322:

package/src/tests/bitcoin.test.ts

@@ -7,6 +7,26 @@ import {
   ProofTypes,
 } from "@notabene/javascript-sdk";
 
+const bitcoinP2WPKHProof: SignatureProof = {
+  type: ProofTypes.BIP137,
+  wallet_provider: "Manual Wallet Signature",
+  status: ProofStatus.PENDING,
+  address: "bip122:000000000019d6689c085ae165831e93:3Q9jfjfbMDuatto7wZ6Tz2aKaDCRHqWWys",
+  did: "did:pkh:bip122:000000000019d6689c085ae165831e93:3Q9jfjfbMDuatto7wZ6Tz2aKaDCRHqWWys",
+  attestation: "I certify that the blockchain address 3Q9jfjfbMDuatto7wZ6Tz2aKaDCRHqWWys belongs to did:pkh:bip122:000000000019d6689c085ae165831e93:3Q9jfjfbMDuatto7wZ6Tz2aKaDCRHqWWys on Wed, 09 Jul 2025 20:17:12 GMT",
+  proof: "HxPmbzvEnvgu0RYIPYl5bWySkFNXwOF/Jegq3NvzjFZ/Ik/koTdV9rh2A7osXefhzTlniUw8YbZNmCeXB9V9qC8=",
+}
+
+const bitcoinP2shProof: SignatureProof = {
+  type: ProofTypes.BIP137,
+  wallet_provider: "Manual Wallet Signature",
+  status: ProofStatus.PENDING,
+  address: "bip122:000000000019d6689c085ae165831e93:1ANiqVALaKwadxA9nvmCUHpBhaopVniuVS",
+  did: "did:pkh:bip122:000000000019d6689c085ae165831e93:1ANiqVALaKwadxA9nvmCUHpBhaopVniuVS",
+  attestation: "I certify that the blockchain address 1ANiqVALaKwadxA9nvmCUHpBhaopVniuVS belongs to did:pkh:bip122:000000000019d6689c085ae165831e93:1ANiqVALaKwadxA9nvmCUHpBhaopVniuVS on Wed, 02 Jul 2025 16:01:44 GMT",
+  proof: "IBo2Im6O5NyuXzBJ+coiTMqmUsqG9bv8NzM3+B5e+5XMB2Xp1n/sIsE/73Jy0EdSvcb334t49+3tdjE/X+sXjFw="
+}
+
 const bip322SegwitTestnetProof: SignatureProof = {
   type: ProofTypes.BIP137,
   address: "bip122:000000000019d6689c085ae165831e93:tb1q0apvgsh48f3rmw224na3ye5rrg37fd796cm0xf",
@@ -89,6 +109,16 @@ const zcashProof: SignatureProof = {
 };
 
 describe("verifyBTCSignature", () => {
+  it("handles bitcoin p2sh addresses", async () => {
+    const result = await verifyBTCSignature(bitcoinP2shProof);
+    expect(result).toEqual({ ...bitcoinP2shProof, status: ProofStatus.VERIFIED });
+  });
+
+  it("handles bitcoin p2wpkh addresses", async () => {
+    const result = await verifyBTCSignature(bitcoinP2WPKHProof);
+    expect(result).toEqual({ ...bitcoinP2WPKHProof, status: ProofStatus.VERIFIED });
+  });
+
   it("handles bip322 segwit testnet addresses", async () => {
     const result = await verifyBTCSignature(bip322SegwitTestnetProof);
     expect(result).toEqual({

package/src/tests/cosmos.test.ts

@@ -0,0 +1,51 @@
+import { describe, expect, it } from "vitest";
+import {
+  ProofStatus,
+  ProofTypes,
+  SignatureProof,
+} from "@notabene/javascript-sdk";
+import { verifyCosmosSignature } from "../cosmos";
+
+describe("verifyCosmosSignature", () => {
+  it("returns verified proof when valid message and address", async () => {
+    const proof: SignatureProof = {
+      type: ProofTypes.COSMOS,
+      did: "did:pkh:cosmos:cosmoshub-4:cosmos1tzxpcdsszyfuj852msx85c24u37jd7rly8skc8",
+      status: ProofStatus.PENDING,
+      attestation:
+        "I certify that\n\ncosmos:cosmoshub-4 account cosmos1tzxpcdsszyfuj852msx85c24u37jd7rly8skc8\n\nbelonged to did:key:z6MksamQq4oVRktkeSDxs6pbixYFUaUca8xgCvnTVLQA5PC5\n\non Mon, 14 Jul 2025 15:09:56 GMT",
+      address:
+        "cosmos:cosmoshub-4:cosmos1tzxpcdsszyfuj852msx85c24u37jd7rly8skc8",
+      proof:
+        "r0L+4864I3p2jPRBt8IAnhhvYmemMkKGg9fcKM0GOBIScgIpmyX/+ObPT/09VMSCzxlzZkH6LQGLNiD2sudAZw==",
+      wallet_provider: "Keplr (Wallet Connect)",
+      chainSpecificData: {
+        pub_key: {
+          type: "tendermint/PubKeySecp256k1",
+          value: "Ak8k3jYgH4srYi1ygG0GWLrdbF7VwQgjiLqjifuJSsmU",
+        },
+      },
+    };
+    const result = await verifyCosmosSignature(proof);
+
+    expect(result.status).toBe(ProofStatus.VERIFIED);
+  });
+
+  it("returns failed proof when invalid message and address", async () => {
+    const proof: SignatureProof = {
+      type: ProofTypes.COSMOS,
+      did: "did:pkh:cosmos:cosmoshub-4:cosmos1tzxpcdsszyfuj852msx85c24u37jd7rly8skc8",
+      status: ProofStatus.PENDING,
+      attestation:
+        "I certify that\n\ncosmos:cosmoshub-4 account cosmos1tzxpcdsszyfuj852msx85c24u37jd7rly8skc8\n\nbelonged to did:key:z6MksamQq4oVRktkeSDxs6pbixYFUaUca8xgCvnTVLQA5PC5\n\non Mon, 14 Jul 2025 15:09:56 GMT",
+      address:
+        "cosmos:cosmoshub-4:cosmos1tzxpcdsszyfuj852msx85c24u37jd7rly8skc8",
+      proof:
+        '{"pub_key":{"type":"tendermint/PubKeySecp256k1","value":"Ak8k3jYgH4srYi1ygG0GWLrdbF7VwQgjiLqjifuJSsmU"},"signature":"invalid_signature_that_will_fail_verification"}',
+      wallet_provider: "Keplr (Wallet Connect)",
+    };
+    const result = await verifyCosmosSignature(proof);
+
+    expect(result.status).toBe(ProofStatus.FAILED);
+  });
+});

package/src/tests/index.test.ts

@@ -342,4 +342,27 @@ describe("verifyProof", () => {
       expect(result.status).toBe(ProofStatus.VERIFIED);
     });
   })
+
+  describe("Cosmos", () => {  
+    const proof: SignatureProof = {
+      type: ProofTypes.COSMOS,
+      did: "did:pkh:cosmos:cosmoshub-4:cosmos1tzxpcdsszyfuj852msx85c24u37jd7rly8skc8",
+      status: ProofStatus.PENDING,
+      attestation: "I certify that\n\ncosmos:cosmoshub-4 account cosmos1tzxpcdsszyfuj852msx85c24u37jd7rly8skc8\n\nbelonged to did:key:z6MksamQq4oVRktkeSDxs6pbixYFUaUca8xgCvnTVLQA5PC5\n\non Mon, 14 Jul 2025 15:09:56 GMT",
+      address: "cosmos:cosmoshub-4:cosmos1tzxpcdsszyfuj852msx85c24u37jd7rly8skc8",
+      proof: "r0L+4864I3p2jPRBt8IAnhhvYmemMkKGg9fcKM0GOBIScgIpmyX/+ObPT/09VMSCzxlzZkH6LQGLNiD2sudAZw==",
+      wallet_provider: "Keplr (Wallet Connect)",
+      chainSpecificData: {
+        pub_key: {
+          type: "tendermint/PubKeySecp256k1",
+          value: "Ak8k3jYgH4srYi1ygG0GWLrdbF7VwQgjiLqjifuJSsmU",
+        },
+      }
+    };
+
+    it("should verify proof", async () => {
+      const result = await verifyProof(proof);
+      expect(result.status).toBe(ProofStatus.VERIFIED);
+    });
+  });
 });